Diwali Sale is live — Enjoy up to 60% off →

Seoul court keeps Coupang's record 423.6 billion won privacy fine in force

The same court paused the orders to fix security and publicly disclose the breach, and a second judge froze a separate 201.1 billion won fine for tracking users' activity.

6 November 2026 • 7 min read

Seoul court keeps Coupang's record 423.6 billion won privacy fine in force

Coupang's bill is 423,575,000,000 won (about $315 million), and a Seoul court has decided the company cannot postpone it. On Thursday 5 November, the Seoul Administrative Court's Fourth Administrative Division, presided over by Judge Kim Young-min, partially granted Coupang's request to suspend enforcement. It suspended the corrective order and publication order issued by the PIPC but rejected the request to suspend the 423.575 billion won fine.

Its reasoning fits in one line. According to AJP, the court said any financial losses resulting from the penalty could be recovered through monetary compensation: if Coupang wins its main case later, it can get the money back. The harm is not irreparable, so the fine stays in force.

That means the largest penalty South Korea has ever issued for a data breach is enforceable while the company argues it should never have been imposed. Coupang has to find the cash before any judge rules on whether the regulator got it right.

What the regulator found, and why it was so large

In June, the Personal Information Protection Commission (PIPC) imposed the fine. The fine was the largest ever imposed in Korea for a single personal data breach, according to the JoongAng Daily, and the Korea Times reported that the commission described it as the largest fine it had imposed on a single firm.

Outlets disagree on the number of affected users. The JoongAng Daily puts it at about 37.5 million, the Korea Times at more than 37 million, and the Korea Herald at more than 33.7 million customers. The Korea Times reported that Coupang belatedly reported a large-scale data breach last November of personal information of users in South Korea, including their names, phone numbers and delivery details. AJP adds that when the breach came to light in November 2025, Coupang initially reported that personal information belonging to about 4,500 customers had been exposed.

When Coupang sued in October, the Herald Business reported that the commission had determined that Coupang failed to maintain basic security measures, including proper management of authentication signing keys and access controls, leading to the data leak.

Coupang filed a lawsuit seeking to revoke the fine and applied for a stay of execution on 7 October, according to Asia Business Law Journal.

The money argument decided it

Both sides argued about Coupang's balance sheet. At a hearing in late October, the company argued that paying the fine would harm its business and negatively impact customers, while also raising concerns regarding fairness. The PIPC replied that Coupang Inc holds more than 2.6 trillion won in cash and cash equivalents and is fully capable of paying, the Herald Business reported. JKN reported that the commission also argued the fine can be paid in six installments over two years.

For scale, the Korea Times reported that Coupang averaged about 36 trillion won in annual sales over the past three years.

Joonsang Lee of Lawbestway, who represented the PIPC, told Asia Business Law Journal: "This is the largest administrative fine imposed by the PIPC." He said the commission argued the company "has sufficient financial capacity to pay the fine, given its substantial cash reserves and revenue".

Thursday's decision does not determine whether the fine itself was legally justified, and a date for the first hearing has yet to be set. AJP reported that Coupang said it would carefully review the court's decision before deciding how to respond. It has not said publicly whether it will pay now, and the reports reviewed don't say whether a refund would come with interest if it wins.

The security fixes are on hold, and a second fine is frozen

What the court paused is less comfortable. The corrective orders, the JoongAng Daily reported, require Coupang to strengthen security measures to prevent similar breaches, notify affected individuals who are not Coupang members and ensure that its chief privacy officer can effectively carry out the role. The court found that the corrective orders and orders requiring public disclosure could cause irreparable harm to Coupang, and it ordered their enforcement suspended until 30 days after a ruling in the main lawsuit. The Korea Herald reported that the court said a temporary suspension would not be severely detrimental to the public interest. The money is enforceable now; the orders to fix security and tell the people affected must wait for the main case.

A day later, a different judge ruled on a different case. The Seoul Administrative Court's Administrative Division 1 (Chief Judge Yang Sang-yoon) on the 6th granted Coupang's request for a stay of execution covering a separate 201.1 billion won fine. In that case the commission had found that Coupang collected and used the online activity records of about 11.17 million users without legal grounds. That fine and its orders are suspended until 30 days after the first-ruling verdict in the main lawsuit. The court said "there is concern that the commission's measures would cause Coupang irreparable harm, and an urgent need to suspend their effect to prevent such harm has been demonstrated."

So within a day of each other, the same court kept one Coupang fine in force and froze the other. Together the two penalties brought the company's total fines to approximately 624.7 billion won.

There is also a diplomatic side to the case. The Korea Times reported that the fine became a point of friction between Seoul and Washington after some US officials and lawmakers questioned whether Coupang's Korean unit was treated unfairly.

For Coupang's customers, the fine pays nothing back, and the reports reviewed say nothing about compensation for victims. According to the Korea Times, names, phone numbers and delivery details were exposed. Anyone who has shopped on Coupang should treat unexpected messages about parcels, refunds or account problems with suspicion and go to the app directly instead of tapping links.